Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Avenue A, Doubleclick, Hitbox, etc. infection

CompassRose

Posted 11 November 2005 - 08:49 PM

CompassRose

New Member

Member

6 posts

Hi,

Earlier this week, I caught an adware infection that keeps coming back despite cleanup. I followed the preliminary steps as outlined: ran the cookie cleanup; downloaded and ran Ad-Aware; downloaded and ran CWShredder and SpyBot as directed; ran ewido; etc. Rebooted and called up my e-mail. Almost immediately, ads start popping up again. Went through all the steps again, and the infections had come back, particularly: Avenue A, DoubleClick, HitBox, and TribalFusion.

Not sure if it's relevant, but both times I rebooted I caught a flash of a message saying something like "The BOOOADMN.EXE application failed to initialize because Windows is shutting down." Never noticed that one before.

Pasted below is the requested information, the ewido report and the Hijack this log. Thank you in advance for any help.

Armodeluxe

Posted 17 November 2005 - 07:08 AM

Armodeluxe

Member 2k

Retired Staff

2,744 posts

I'm surprised that no viruses were found (just a few in your system restore points) despite your running your computer without an antivirus program. To clarify, Ewido is not an antivirus, it is just an antitojan program. Nevertheless, you need a resident antivirus program. Please download AVG, it is a free program..you can find the link in my signature..install, update, make a scan and remove if it finds anything..

Now let's remove the infections..

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

Now the infections you're talking about in your headline are just cookies. You get cookies installed on your computer just by visiting web pages. Now some of these are good and some are spyware, which mostly are third party cookies. You can block them by doing the following.

In Firefox go to Tools > Options > Privacy > Cookies

Click the small triangle next to cookies to expand that tab and put a check next to "for the originating website only". This will prevent third party cookies from being installed on your computer.

In IE go to Tools > Internet Options > Privacy and click on Advanced in the Privacy tab

Now put a check next to "Override automatic cookie handling"

Set first party cookies to Accept and third party cookies to Block

Also put a check to "Always allow session cookies" OK your way out.

Now this won't prevent all spyware cookies, but will reduce the amount significantly. The rest you can clean with scans by programs like Adaware, Spybot, Ewido.

Please post a new HijackThis log and say if you are still having any problems..

CompassRose

Posted 18 November 2005 - 12:43 AM

CompassRose

New Member

Topic Starter

Member

6 posts

Thanks for your help so far.

Followed your instructions and then ran adaware and spybotS&D to sweep a few cookies out. I didn't get any popups for about an hour, but now I'm getting almost as many annoying ads as before, particularly from http://adyieldmanager.com. It's irritating, since I've never had this problem before.

Do you see anything else here? Thanks again for taking the time to help out.

Then please reboot your computer in Safe Mode by doing the following:1) Restart your computer2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.3) Instead of Windows loading as normal, a menu should appear4) Select the first option, to run Windows in Safe Mode.

Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.

When the tool is finished, make a scan with Ewido:

Open Ewido

Click on scanner

Click Complete System Scan

Let the program scan the machine

While the scan is in progress you will be prompted to clean the first infected file it finds. Choose "remove", then put a check next to "Perform action on all infections" in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

Click Save report

Save the report to your desktop

Exit Ewido

Please reboot back into normal mode, and post a new HijackThis log, along with the entire contents of the log.txt file in the aproposfix folder and the log from Ewido.

- Once you are on the Panda site click the Scan your PC button- A new window will open...click the Check Now button- Enter your Country- Enter your State/Province- Enter your e-mail address and click send- Select either Home User or Company- Click the big Scan Now button- If it wants to install an ActiveX component allow it- It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)- When download is complete, click on Local Disks to start the scan- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Armodeluxe

Posted 20 November 2005 - 09:44 AM

1. Turn off System Restore.On the Desktop, right-click My Computer.Click Properties.Click the System Restore tab.Check Turn off System Restore.Click Apply, and then click OK.

2. Turn ON System Restore.On the Desktop, right-click My Computer.Click Properties.Click the System Restore tab.UN-Check *Turn off System Restore*.Click Apply, and then click OK.

Please take the following into consideration to maintain a clean computer.

Now you should go get a firewall. Don't rely on the Windows firewall as it monitors only incoming traffic. Pick one of these, they are all free.KerioZonealarmSygate

I'll also recommend you to install a monitoring software which will monitor certain areas on your computer and will place alerts when those are being modified. One such software I'll recommend is Prevx, but it's for advanced users as the messages it displays can be hard to decipher. One other similar but more user friendly software is Winpatrol. Both are free programs.WinpatrolPrevx

Visit Windows Update regularly to get the latest security updates.You can also enable automatic updates.Your antivirus software and antispyware programs should also be updated regularly. Make a habit of running scans on a timely basis. Be careful about what you download, scan every file before clicking on it.